Page History

h1, h2, {font-size: 18pt !important;}
h3 {font-size: 16pt !important;}
h4 {font-size: 14pt !important;}
h5 {font-size: 14pt !important;}

.wiki-content h1 {
border-top: 1px solid rgb(145,150,153);
}

SBC 5x10, 5400, 7000 and SWe are represented as SBC Core in the subsequent sections.

This configuration guide is offered as a convenience to Ribbon customers. The specifications and information regarding the product in this guide are subject to change without notice. All statements, information, and recommendations in this guide are believed to be accurate but are presented without warranty of any kind, express or implied, and are provided “AS IS”. Users must take full responsibility for the application of the specifications and information in this guide.

• ZPLS version is 1.8.0.73 or later.
• Zoom Client version is 5.11.10 (8200) or later. 
• Jitsi version is 2.10.5550 or later

Mgmt is an RJ45 port and is the management interface of the SBC.

Media 0/Media1 depicted as pkt0/pkt1 are RJ45 OR optical SFP ports. Media 0 and Media 1 are used in the current deployment and the same interfaces can be used in SBC Core 5K and 7K (appliance based). Typically, on 5K/7K these ports would be optical SFPs.

For the SBC SWe (virtualized platform), the logical pkt0/pkt1 interface must be mapped to a physical port.

• For smaller networks with just one or two routes, configuring static routing is preferable. This is more efficient since a link is not wasted by exchanging dynamic routing information.
• For networks that have a LAN-side Gateway on Voice VLAN or Multi-Switch Edge Devices (MSEs) with Voice VLAN towards SBC Core, static routing configurations are not required.
  

Add the static route once the PSTN Leg and ZPLS Leg configurations are done on the SBC.

set addressContext default staticRoute 0.0.0.0 0 10.54.X.X LIF1 PKT0_V4 preference 100
commit

set addressContext default staticRoute 0.0.0.0 0 172.16.X.X LIF2 PKT1_V4 preference 100
commit

# To create a Certificate Signing Request (CSR) and key file for a Subject Alternative Name (SAN) certificate with multiple subject alternate names, complete the following procedure:
  
Create an OpenSSL configuration file (text file) on the local computer by editing the fields to the company requirements.
  
Note 1: In the example used in this article, the configuration file is req.conf.
  
Note 2: req_extensions will put the subject alternative names in a CSR, whereas x509_extensions would be used when creating an actual certificate file.
  
[req]
        distinguished_name = req_distinguished_name
        req_extensions = v3_req
        prompt = no
        [req_distinguished_name]
        C = US
        ST = VA
        L = SomeCity
        O = MyCompany
        OU = MyDivision
        CN = www.company.com
        [v3_req]
        keyUsage = keyEncipherment, dataEncipherment
        extendedKeyUsage = serverAuth
        subjectAltName = @alt_names
        [alt_names]
        DNS.1 = www.company.com
        DNS.2 = company.com
        DNS.3 = www.company.net
        DNS.4 = company.net
  
Make sure there are no whitespaces at the end of the lines.
  
#Run the following commands to create the Certificate Signing Request (CSR) and a new Key file:
openssl req -new -out company_san.csr -newkey rsa:2048 -nodes -sha256 -keyout company_san.key.temp -config req.conf
  
#Run the following command to verify the Certificate Signing Request:
openssl req -text -noout -verify -in company_san.csr
   
#After receiving the CSR with the above information, provide it to CA (Certificate Authority). You will then receive the proper CA signed certificate in .crt format that is convertable into other formats using openssl.
 
#By default, you should receive two or more certificates from CA (depanding upon your CA). One is the SBC certificate, and the other is CA's root and intermediate certificate.
 
#Upload the certificates to the SBC at /opt/sonus/external and convert them into an SBC-readable format, i.e. SBC certificate is in .pem or .p12 format and root certificate is in .cer or .der.
  
#Convert .crt to .pem USING OPENSSL for SBC certificate.
openssl x509 -in sbc_cert.crt -out sbc_cert.der -outform DER
openssl x509 -in sbc_cert.der -inform DER -out sbc_cert.pem -outform PEM
  
#After generating sbc_cert.pem file, convert it to .p12 format using the command below and the location of the certificate key.
openssl pkcs12 -export -out sbc1_cert.p12 -in sbc_cert.pem -inkey /opt/sonus/company_san.key.temp
  
#CONVERTING CRT to CER USING OPENSSL for CA's root and intermediate certificate.
openssl x509 -in root_cert.crt -out root_cert.cer -outform DER
  
After converting all these certificates, upload them on SBC at /opt/sonus/external location.

#Import Public CA Root Certificate into database.
set system security pki certificate CA_ROOT_CERT type remote fileName root_cert.cer state enabled
 
#Import Public CA Certified SBC Server Certificate into database.
set system security pki certificate SBC_CERT filename sbc1_cert.p12 passPhrase <Password defined during CSR generation> state enabled type local

#Import Public Digicert Global Root CA Certificate into database.
set system security pki certificate DIGI_ROOT type remote fileName DigiCertGlobalRootCA.crt state enabled

#Import Public Digicert Global G2 Certificate into database.
set system security pki certificate DIGI_ROOT_G2 type remote fileName DigiCertGlobalRootG2.pem state enabled

set profiles security tlsProfile TLS_PROF clientCertName SBC_CERT serverCertName SBC_CERT cipherSuite1 tls_ecdhe_rsa_with_aes_256_cbc_sha384 cipherSuite2 tls_ecdhe_rsa_with_aes_128_cbc_sha authClient true allowedRoles clientandserver acceptableCertValidationErrors invalidPurpose
set profiles security tlsProfile TLS_PROF v1_1 enable
set profiles security tlsProfile TLS_PROF v1_0 disable
set profiles security tlsProfile TLS_PROF v1_2 enable
commit

Attach the TLS Profile to the SIP Signaling Port that will be created later in ZPLS Leg Configuration.

set addressContext default zone ZOOM sipSigPort 7 state disabled mode outOfService
commit
set addressContext default zone ZOOM sipSigPort 7 tlsProfileName TLS_PROF
commit
set addressContext default zone ZOOM sipSigPort 7 state enabled mode inService
commit

set system mediaProfile compression 75 tone 25
commit

This configuration is not required for SBC SWe 7.2 release onwards.

set profiles media toneAndAnnouncementProfile LRBT_PROF
set profiles media toneAndAnnouncementProfile LRBT_PROF localRingBackTone signalingTonePackageState enable
set profiles media toneAndAnnouncementProfile LRBT_PROF localRingBackTone precedence lower
set profiles media toneAndAnnouncementProfile LRBT_PROF localRingBackTone makeInbandToneAvailable enable
set profiles media toneAndAnnouncementProfile LRBT_PROF localRingBackTone flags useThisLrbtForEgress enable
set profiles media toneAndAnnouncementProfile LRBT_PROF localRingBackTone flags useThisLrbtForIngress enable
set profiles media toneAndAnnouncementProfile LRBT_PROF localRingBackTone flags dynamicLRBT enable
commit

set profiles media codecEntry G711ULAW codec g711
set profiles media codecEntry G711ULAW law ULaw
set profiles media codecEntry G711ULAW packetSize 20
set profiles media codecEntry G711ULAW dtmf relay rfc2833
commit

set profiles media packetServiceProfile PSTN_PSP codec codecEntry1 G711ULAW
set profiles media packetServiceProfile PSTN_PSP rtcpOptions rtcp enable
commit

set profiles signaling ipSignalingProfile PSTN_IPSP
set profiles signaling ipSignalingProfile PSTN_IPSP egressIpAttributes flags disable2806Compliance enable
commit

Replace "x.x.x.x" with the SBC's packet interface (pkt) IP address towards PSTN (example pkt0 IP), and "Y" with its prefix length. Provide ceName used during an SBC deployment.

Here the ceName is "ZPLS1".

set addressContext default ipInterfaceGroup LIF1 ipInterface PKT0_V4 ceName ZPLS1 portName pkt0
set addressContext default ipInterfaceGroup LIF1 ipInterface PKT0_V4 ipAddress x.x.x.x prefix Y
set addressContext default ipInterfaceGroup LIF1 ipInterface PKT0_V4 mode inService state enabled
commit

This Zone groups the set of objects used for the communication towards PSTN.

set addressContext default zone PSTN id 2
commit

Replace "x.x.x.x" with SIP Signaling Port IP of SBC towards PSTN.

set addressContext default zone PSTN sipSigPort 3 ipInterfaceGroupName LIF1
set addressContext default zone PSTN sipSigPort 3 ipAddressV4 x.x.x.x
set addressContext default zone PSTN sipSigPort 3 portNumber 5060
set addressContext default zone PSTN sipSigPort 3 transportProtocolsAllowed sip-udp
set addressContext default zone PSTN sipSigPort 3 mode inService
set addressContext default zone PSTN sipSigPort 3 state enabled
commit

Replace "x.x.x.x" with the PSTN IP.

set addressContext default zone PSTN ipPeer PSTN_IPP ipAddress x.x.x.x
set addressContext default zone PSTN ipPeer PSTN_IPP ipPort 5060
commit

You must configure Trunk Group names using capital letters.

set addressContext default zone PSTN sipTrunkGroup PSTN_TG media mediaIpInterfaceGroupName LIF1 
set addressContext default zone PSTN sipTrunkGroup PSTN_TG mode inService state enabled
commit

set addressContext default zone PSTN sipTrunkGroup PSTN_TG policy signaling ipSignalingProfile PSTN_IPSP
set addressContext default zone PSTN sipTrunkGroup PSTN_TG policy media packetServiceProfile PSTN_PSP
set addressContext default zone PSTN sipTrunkGroup PSTN_TG policy media toneAndAnnouncementProfile LRBT_PROF
set addressContext default zone PSTN sipTrunkGroup PSTN_TG ingressIpPrefix 0.0.0.0 0
commit

set global callRouting routingLabel PSTN_RL routingLabelRoute 1 trunkGroup PSTN_TG
set global callRouting routingLabel PSTN_RL routingLabelRoute 1 ipPeer PSTN_IPP
set global callRouting routingLabel PSTN_RL routingLabelRoute 1 inService inService
commit

Provide ceName used during an SBC deployment. "ZPLS1" is the ceName.

set global callRouting route trunkGroup PSTN_TG ZPLS1 standard Sonus_NULL 1 all all ALL none Sonus_NULL routingLabel ZOOM_RL
commit

set profiles media codecEntry G711_Zoom codec g711
set profiles media codecEntry G711_Zoom law ULaw
set profiles media codecEntry G711_Zoom packetSize 20
set profiles media codecEntry G711_Zoom dtmf relay rfc2833
commit

set profiles security cryptoSuiteProfile CRYPT_PROF entry 1 cryptoSuite AES-CM-128-HMAC-SHA1-80

set profiles media packetServiceProfile ZOOM_PSP codec codecEntry1 G711_Zoom
set profiles media packetServiceProfile ZOOM_PSP rtcpOptions rtcp enable
set profiles media packetServiceProfile ZOOM_PSP secureRtpRtcp cryptoSuiteProfile CRYPT_PROF
set profiles media packetServiceProfile ZOOM_PSP secureRtpRtcp flags allowFallback enable
set profiles media packetServiceProfile ZOOM_PSP secureRtpRtcp flags enableSrtp enable
commit

• The SBC Core to Zoom transport type is TLS and therefore enables the same transport type in ZOOM_IPSP.
• ZPLS expects the transport type in Contact header, hence the flag "includeTransportTypeInContactHeader" need to be enabled.

set profiles signaling ipSignalingProfile ZOOM_IPSP
set profiles signaling ipSignalingProfile ZOOM_IPSP egressIpAttributes flags disable2806Compliance enable
set profiles signaling ipSignalingProfile ZOOM_IPSP egressIpAttributes numberGlobalizationProfile DEFAULT_IP
set profiles signaling ipSignalingProfile ZOOM_IPSP egressIpAttributes transport type1 tlsOverTcp
set profiles signaling ipSignalingProfile ZOOM_IPSP commonIpAttributes flags includeTransportTypeInContactHeader enable 
commit

Replace "x.x.x.x" with the SBC's packet interface (pkt) IP address towards ZOOM (example pkt1 IP), and "Y" with its prefix length. Provide the ceName used during an SBC deployment.

Here the ceName is "ZPLS1".

set addressContext default ipInterfaceGroup LIF2 ipInterface PKT1_V4 ceName ZPLS1 portName pkt1
set addressContext default ipInterfaceGroup LIF2 ipInterface PKT1_V4 ipAddress x.x.x.x prefix Y
set addressContext default ipInterfaceGroup LIF2 ipInterface PKT1_V4 mode inService state enabled
commit

This Zone groups the set of objects used for communication towards Zoom.

set addressContext default zone ZOOM id 6
commit

Replace "x.x.x.x" with the SIP Signaling Port IP address of the SBC towards ZPLS.

set addressContext default zone ZOOM sipSigPort 7 ipInterfaceGroupName LIF2
set addressContext default zone ZOOM sipSigPort 7 ipAddressV4 x.x.x.x
set addressContext default zone ZOOM sipSigPort 7 portNumber 5060
set addressContext default zone ZOOM sipSigPort 7 tlsProfileName TLS_PROF
set addressContext default zone ZOOM sipSigPort 7 transportProtocolsAllowed sip-tls-tcp
set addressContext default zone ZOOM sipSigPort 7 mode inService
set addressContext default zone ZOOM sipSigPort 7 state enabled
commit

You created the TLS profile in TLS Profile.

There are a few areas that result in a TLS negotiation issue. One area involves assigning the incorrect port. Ensure the following are accomplished: 

• Zoom listens on port number 5061 (default setting).

• Configure port number 5060 on Zoom IP-Peer since Ribbon SBC Core increments the port by 1 when the transport protocol is TLS.

Replace "x.x.x.x" with the Zoom SIP signaling IP.

set addressContext default zone ZOOM ipPeer ZOOM_IPP ipAddress x.x.x.x
set addressContext default zone ZOOM ipPeer ZOOM_IPP ipPort 5060
commit

set profiles services pathCheckProfile ZOOM_OPTIONS protocol sipOptions sendInterval 20 replyTimeoutCount 1 recoveryCount 1
set profiles services pathCheckProfile ZOOM_OPTIONS transportPreference preference1 tls-tcp
commit

You must configure Trunk Group names using capital letters.

set addressContext default zone ZOOM sipTrunkGroup ZOOM_TG media mediaIpInterfaceGroupName LIF2 
set addressContext default zone ZOOM sipTrunkGroup ZOOM_TG mode inService state enabled
commit

set addressContext default zone ZOOM sipTrunkGroup ZOOM_TG policy signaling ipSignalingProfile ZOOM_IPSP
set addressContext default zone ZOOM sipTrunkGroup ZOOM_TG policy media packetServiceProfile ZOOM_PSP
set addressContext default zone ZOOM sipTrunkGroup ZOOM_TG policy media toneAndAnnouncementProfile LRBT_PROF
set addressContext default zone ZOOM sipTrunkGroup ZOOM_TG ingressIpPrefix 0.0.0.0 0
commit

set global callRouting routingLabel ZOOM_RL routingLabelRoute 1 trunkGroup ZOOM_TG
set global callRouting routingLabel ZOOM_RL routingLabelRoute 1 ipPeer ZOOM_IPP
set global callRouting routingLabel ZOOM_RL routingLabelRoute 1 inService inService
commit

Provide the ceName used during an SBC deployment. "ZPLS1" is the ceName.

set global callRouting route trunkGroup ZOOM_TG ZPLS1 standard Sonus_NULL 1 all all ALL none Sonus_NULL routingLabel PSTN_RL
commit